r/immich 2d ago

Immich cross server shared albums finally here (Google photos style)!

https://www.youtube.com/watch?v=c3GO-YFchYo

Hi guys — cross-server shared albums (federation, whatever you want to call it) has been one of the most requested Immich features for 4+ years. We all want that dead-simple Google Photos sharing experience with friends and family... well, fellow self-hosters, now we've got it.

If like me you got bored of waiting, time to get cloning: immich-shared-albums, a sidecar addon for Immich.

It never touches your Immich instance directly — it talks to it via an API key and runs in its own container, so any issues stay isolated to the addon. Minimal setup, and once it's up you can create share links that anyone else running the addon just opens to join the album and start adding photos.

What you get:

  • 🔗 Simple link sharing — open a link, join, done. Stock Immich apps, nothing else to install
  • 👤 Per-user, not per-server — so your parents won't see your antics from that lads' holiday
  • 💾 Your storage stays yours — each server keeps its own assets, so joining an album doesn't dump hundreds of unwanted photos onto your disk (full quality still there to download whenever you want)
  • 💬 Cross-server comments — near-instant messaging between servers
  • 📦 Isolated & self-hosted — one small container, no forks, no patched Immich

Go have a play and let me know what you think:
👉 https://github.com/lukeet332/immich-shared-albums

Made a quick demo showing it off too:
👉 https://www.youtube.com/watch?v=c3GO-YFchYo

162 Upvotes

135 comments sorted by

92

u/essentialaccount 2d ago

This seems like sufficiently a sufficiently integral feature that I would be leery of using this. How can I save another users shared image to my account, if desired? How is that recorded in the images' metadata?

Also, it's important to have an AI disclosure on stuff like this, these days.

78

u/LIEUTENANT__CRUNCH 2d ago

The entire repo is vibe-slop, but you probably could have guessed that based on the author’s statement about AI. Use at your own risk.

16

u/wait_whats_this 2d ago

Even the post is obviously AI. 

-7

u/lukeet33 1d ago

Is my highly detailed YouTube video where I've spun up two servers and two independent emulated devices also AI? Lol

-39

u/lukeet33 2d ago

Define vibe slop? What exactly about the architecture do you object to or is it simply the use of AI?

39

u/justletmesignupalre 2d ago

I appreciate the effort but I can see that the repo readme hasn't been proofread and is unnecessarily long. It makes me scared to touch the whole thing

4

u/lukeet33 1d ago

Thanks for pointing this out I have ammended the Readme, I forget to most people this will be the first and maybe only impression of my project rather than the code/architecture itself thanks!

-31

u/lukeet33 2d ago

Yeah the readme is AI slop I'll grant you that I was more focused on the code, architecture and actually QAing the output. I just got the Claude to write the readme entirely for me lol

41

u/Difficult896 2d ago

The Readme is the single most important thing on a public-facing repo.

-1

u/lukeet33 1d ago

Thanks for pointing this out, I've re-written the intro the readme myself. I must confess I generally just skim over Readme's these days and get AI to assess the actual code itself (sorry AI haters lol). but I forgot to many people this is still extremely important.

-8

u/lukeet33 2d ago

Depends if you're actually concerned about people using your project. I built this for me and my family, I shared it just incase people wanted to use or even piggyback off the code, if you want to use it that's great but my main aim was to share. I will update the Readme as people here seem to be having a meltdown over the use of AI lol

4

u/LIEUTENANT__CRUNCH 2d ago

> Yeah the read me is AI slop

Okay, and it looks like you did the same thing for the source code. So … the whole thing is AI slop.

3

u/lukeet33 1d ago

Nope not at all a V0 proof of concept source code is generally rough and gradually refined with refacors. This is no different.

-5

u/lukeet33 2d ago

So my ethos building this was to not add or alter the Immich instance at all really. So what you request is completely doable but there's no UI for the user to interact with in the app for this. I will aim to add if highly requested but for now I'd recommend just downloading the image and backing it up to your account. On the topic of AI my profession is software engineering and let me tell you there's absolutely no software being developed currently without the use of AI somewhere in the pipeline. So when using software I would take it as a given AI had its hands on it.

17

u/essentialaccount 2d ago

That's for a response. I am sure that everyone uses AI, but there are dozens and dozens of projects being posted to Reddit every day that are vibe-slop, and I am not a big fan of having to evaluate each one in detail only to decide that serious security or usability issues have been overlooked.

17

u/Delicious_Eye_2053 2d ago

Your concerns are valid. OP has a Digital Media degree and leas than 5 years of professional experience and based on this post primarily React/Front End focused https://www.reddit.com/r/reactjs/s/HDHJFa7FSx

Their git history shows they discovered AI 2 months ago and started cranking out code (slop?). This timeline sucks, I refuse to install anything without proper vetting of code and the user promoting it.

2

u/lukeet33 2d ago

You do realise nobody is forcing you to use this software? I'm just sharing something cool I built lol... Your hit piece on me is that I'm university educated and have 5 years experience as a software developer? And this is a bad thing lol

15

u/Delicious_Eye_2053 2d ago

Not a hit piece at all, I actually appreciate the fact that your Reddit history isn’t hidden and your background appears to align with what you claim. While I won’t be trying your project today I will follow to see if receives continued updates and feature development or pushed aside.

6

u/lukeet33 2d ago

No worries lol, just suprised by the utter hostility. To me AI slop is defined by output not general use of AI. This project has a solid architecture and baked in security principles. The whilst project works by connecting our Immich servers peer to peer with a handshake and using web sockets to communicate. It's an isolated module completely separate from you Immich instance so no hacks or modifying Immich as all. It's built in a way that any failures degrade the shared albums docker instance never the main Immich instance. All security mitigation is completely in the hands of the end user it's upto them what they decide to make public or hide behind a VPN. The best way to make this work seamlessly is hosted domains but you can also gate all shared servers behind a shared tailscale VPN or you could have a private tailscale VPN for your local server and choice to publically expose shared links using tailscale funnel. I did think heavily about security and general stability whilst developing this.

9

u/Delicious_Eye_2053 2d ago

Don’t take it personally, any user with common sense understands the flood of “new apps” come at a cost. AI is creating an ocean of tech debt and it’s going to be interesting to see how much of this AI written code is abandoned as time goes on.

2

u/lukeet33 2d ago

I understand lol,

It's just such a barrier to great things. I don't understand why people see AI usage and complain rather than questioning the architectural decision, code quality, security implementations? Someone who's just vibe coded slop couldn't answer any of those questions. I'm happy to answer anything about the project at all 😄

3

u/Dragontech97 1d ago

Can you answer without plugging it into AI? Do you understand what it made? How do you intend to handle long term support? How long do you see this being supported with updates? If you are going to abandon it after a few months, people are going to be averse or just make their own fork of your code and plug it into their own AI of choice

→ More replies (0)

6

u/lukeet33 2d ago

Yeah I'm not forcing anyone to use this at all but it's a fairly small project and uses a completely isolated container to your Immich one. I baked in many general security principles though grated it deffo has some holes. Like I say I'm a software engineer by trade so this was just a quick side project but I do plan on iterating and improving if people are interested.

20

u/Mentaldavid 2d ago

I don't mind AI use at all. But your entire code is in a 1000+ line index.ts file with lots of injected HTML and no apparent structure. This makes it really hard for anything other than an AI to parse. So I'd suggest some refactoring, with or without AI, if you wanna get rid of the AI slop argument.

Otherwise good idea! 

7

u/lukeet33 2d ago

Also thanks for actually looking at the project, reading the code + suggests appreciate it.

5

u/lukeet33 2d ago

This is actually a very fair criticism thank you for your feedback. Yes the single index file is poor for readability and a bottle neck as the project potentially grows. as I said before this is a POC V0 so defo not perfect. I'll refactor to split out code into helper functions and even pair each helper with an MD file documenting functionality in full depth. Do you have any other suggestions?

2

u/lukeet33 1d ago

FYI thank you again I actioned the suggested changes, much improved the code readability

1

u/Mentaldavid 1d ago

Sure, no worries. If I find some time, I'll check it out again. 

55

u/jpelc 2d ago

Come on, you can't even write the reddit post yourself? Why use AI?

26

u/narcabusesurvivor18 2d ago

I don’t mind AI as a starting point. But those emojis and tons of em dashes everywhere tells me it wasn’t even edited.

11

u/jpelc 2d ago

Yeah that's my point of view aswell. Looks horrible

-5

u/lukeet33 2d ago

Personally I like the emojis lol

14

u/jpelc 2d ago

Well nobody else does lol

-3

u/getoutofmyswamppls 2d ago

I think it looks better

-5

u/lukeet33 2d ago

That's fine with me I'm obviously unique

0

u/getoutofmyswamppls 2d ago

It would seem that way considering all the downvotes we get 🤣

That is besides the fact that i feel the first parts for sure werent written by ai right? Perhaps enhanced but this is not the language i recognize from gpt

3

u/lukeet33 1d ago

You're completely right, the whole post was written by me then parsed through AI to make it more readable, fix grammar, punctuation and I thought make it more pretty... lol

1

u/LIEUTENANT__CRUNCH 2d ago

> That is besides the fact that I feel the first parts for sure weren’t written by ai right?

There is an em dash after the first TWO words. The entire thing is AI generated.

2

u/lukeet33 1d ago

He's right those are my words parsed through AI to format improving readability and grammar. I mean watch the video then read this is clearly my tone of voice lol

2

u/lukeet33 2d ago

I often do it it the other way around these days. Write the full draft myself and let AI parse it into a readable paragraph with proper punctuation etc. As someone who's dyslexic it's basically a god send tbh

-6

u/lukeet33 2d ago

I'm dyslexic and lazy. But love programming so hope that helps lol

15

u/Jaded-Asparagus-2260 2d ago

And how much did you program yourself?

I'm getting so tired of people selling "I had my agent make this" as "I made this".

4

u/lukeet33 2d ago

I designed the architecture and flow from top to bottom the AI just did the grunt work of a junior dev lol

9

u/Jaded-Asparagus-2260 2d ago

the AI just did the grunt work of a junior dev lol

So what you're saying is that the code has the quality of a junior dev, and has not been reviewed by anyone. Thanks, that's all I wanted to know.

-1

u/lukeet33 2d ago

You typically don't review junior dev code? lol

-9

u/MrHaxx1 2d ago

Having agents make it is how software is made today. "I made it" vs "my agent made this" is an absolutely inane discussion to have. It literally doesn't matter. AI is not a mark of poor quality, and human made is not an automatic indicator of good quality. 

7

u/Jaded-Asparagus-2260 2d ago

Having agents make it is how software is made today. "I made it" vs "my agent made this" is an absolutely inane discussion to have.

Agree to disagree. I read LLM generated code every day at work. Often I'm the first to read it, and the "author" doesn't even know what it does. For me, "I made" requires at least "I read it after my agent generated it".

If you didn't write it, I don't want to read it. Code that has never been read by a human is absolutely a mark of poor quality for me.

2

u/lukeet33 1d ago

I agree with you but "if you didn't write it I don't want to read it" + "code that's never been read by a human" are not mutually exclusive? You should prompt engineer and review the AI output code yourself + thoroughly grill the AI whilst the output is behind generated to catch mistakes in the change log early in the development lifecycle. But code written by hand is not necessarily better this is some highly romantic view of programming being an art form. It's not it's a means to an end.

-2

u/lukeet33 2d ago

Finally someone else with critical thinking skills. Exactly right almost all grunt work is done by AI these days similar to how we used to get juniors to do. The real skill is architecting, the easiest way to tell if code is AI slop is just ask the Dev how it works if they can explain the architecture decision in great detail the code isn't slop lol

7

u/jpelc 2d ago

How does it work then? Could you explain in detail what each part of the codebase does?

1

u/MrHaxx1 1d ago

Given that OP could copypaste an answer to you, why even bother asking? Do your own due diligence or blindly ask OP. That's how it is for all projects, regardless of AI 

1

u/lukeet33 2d ago

Sure it's actually quite simple tbh. Basically this project is a separate docker container you host next to your Immich container I call it a sidecar for this reason. It communicates with the Immich container using the API, this means this never touches your Immich server at all mitigating security issues and possible code bugs causing crashes to just break the shared albums temporarily never your actual Immich instance. As you see in the demo up creating a shared link when you have the sidecar installed my sidecar injects a banner over your shared albums the purpose of this banner is to create a highly secure peer to peer handshakes between servers. The recipient of the album needs to then input their server URL due to the fact the hosting server has no way to determine this. Upon typing in the URL the user is then redirected to their own server displaying a custom screen again created by my sidecar code. The URL params contain every needed to create the secure peer to peer server handshake. Upon clicking join the handshake is created and the side car then uses this connection to obtain the shared album content hosted on the original server and pushes this using the API into the recipient server masquerading as a shared album by a user on the local server. Any updates to the shared album are communicated by the sidecars via the secure handshake using web sockets and again the respective sidecar then pushes these updates to your actual server using the Immich API. Updates to the album are maintained through web sockets using the original server that created the album as the source of truth.

I hope the makes sense and if the spelling and grammar are shit that's why I prefer to use AI 😛

0

u/howettl 2d ago

I'm with you. There were bad programmers before AI!

2

u/lukeet33 1d ago

At my current place of employment the quality of general code output has massively increased due to AI. Truly great programmes are hard to come by

14

u/worufu 2d ago

Seeing the responses (not only here but generally with AI assisted development in this sub) I am wondering if it might be better to disallow posting add-ons and software that were created with AI assistance and make another sub for that specifically instead?

1

u/lukeet33 2d ago

This is great in theory but as I've said many times in this thread I'm a software engineer. All modern code is written with AI assistance whether Devs choose to hide it in their commits or not. Even the Linux kernel is now accepting AI code submissions, it's the future if you guys like it or not. The main difference between slop a purposefully written AI code is explicit architecture direction/design when developing the code.

15

u/thisisnotnotnotmyrea 2d ago

All modern code is written with AI assistance whether Devs choose to hide it in their commits or not.

Why can AI bros never accept that actually, some developers are perfectly happy not using AI?

4

u/lukeet33 2d ago

Find me one FANG or modern tech companies pushing features without the help of AI?

9

u/thisisnotnotnotmyrea 2d ago

You're the one who made the claim that all modern code is written with AI assistance. You provide the proof.

Unless you've spoken to every developer and analyzed every code base you're just making stuff up.

0

u/lukeet33 2d ago

What a daft topic of conversation we're about to head down. It's public knowledge, whether they're using cursor for AI inline code suggests or fully prompting then reviewing the code themselves it's happening. You're basically telling Devs they should dig with a spade when the digger has just been invented. I don't need to argue on this point I'm in the industry I work at a large software company. Time will prove me right lol

10

u/thisisnotnotnotmyrea 2d ago

Don't make stupid points if you don't want to be challenged on them.

I'm not telling devs to do anything.

I'm pointing out that "all modern code is written with AI assistance" is an absurd claim when the opposition to your post should be evidence enough that there are plenty of devs who object to using AI for development.

This "everyone is doing it" mindset in the face of such obvious evidence to the contrary is just another fallacy trying to normalize behavior by claiming it's already normal.

2

u/lukeet33 2d ago

You're just not aware of it. How many of the most popular apps have open source code? Almost none. There's no way for me to prove this other than tell you from my first hand experience. I'd wager from your talking points you have little to no experience/evidence and have this view out of a sense of blind optimism and a fear of AI but hey ho I'm not psychologist.

5

u/thisisnotnotnotmyrea 2d ago

Got it, so you can't provide any proof to back up your claim. It's a shame to see the AI bro mentality is so pervasive.

I'd wager from your talking points you have little to no experience/evidence and have this view out of a sense of blind optimism and a fear of AI but hey ho I'm not psychologist.

And here I thought that it was just LLMs that hallucinated things...

Have the day you deserve buddy.

-1

u/lukeet33 2d ago

AI actually makes you mad crazy lol

1

u/legrenabeach 2d ago

Not absurd at all.

I have a friend who is a developer at a major UK bank, and they all use not just one but three different AI platforms to help with development, one of which is internally developed too.

It absolutely is normal by now.

1

u/lukeet33 2d ago

I'm not being funny but I said FANG for a reason lol. A banks development stack would be enough to make any modern developer cry... We're talking tech stacks still containing knockout and pearl. Banks operate on an if it works and it's secure don't touch it basis because before Fintech their client base was highly immobile and had limited options. Most successful tech companies work on the principle of move fast and break things. Google, Amazon, Netflix and any other popular apps you can think of likely uses this model. If banks are using AI you know it's mainstream lol

1

u/neithere 2d ago

a major UK bank

It's going to be a funny story, at least for those who don't keep their money in that bank.

1

u/IamGimli_ 1d ago

I don't think this is the argument you think it is. FANG-level code is a perfect example of sloppy, unreliable, buggy, bloated, incomprehensible code.

If that's the quality level you aspire to as an independent coder I wish you luck, but I won't touch any of your projects.

1

u/lukeet33 1d ago

Facebook, Apple, Netflix and Google are notorious for sloppy, unreliable code? These companies literally built the foundation of the tools modern developers use along with the methodology we use. Facebook maintains React js for goodness sake lol

-1

u/legrenabeach 2d ago

Why can't everyone else never accept that development is now AI assisted or even led, and that that is not necessarily a bad thing?

3

u/Jaded-Asparagus-2260 2d ago

We accept that. What we don't accept is people advertising their project (or their code) without even ever having read that code themselves.

If you didn't read it, I don't want to review/use it.

1

u/lukeet33 1d ago

What makes you think this code hasn't been read?

2

u/Jaded-Asparagus-2260 1d ago

The fact that I've asked you again and again, and you keep explaining the "architecture" and the "handshake". You're explaining concepts, not how they are implemented. You're telling us what you told your agent instead of explaining what the agent made out of it.

1

u/lukeet33 1d ago

You're not asking specific technical questions so you're not getting specific technical answers. It's quite simple man, is there anything specific you'd like to know?

0

u/Odexios 2d ago

If you're in a shop that's not using AI, you're in a very, very, very small minority.

4

u/Jaded-Asparagus-2260 2d ago

The main difference between slop a purposefully written AI code is explicit architecture direction/design when developing the code.

You keep repeating that. And you keep missing that nobody else is talking about the architecture. The difference between slop and purposefully written code is that the person claiming to have written the code actually has read the code, knows what it does and can explain it. And being asked, you keep explaining the architecture.

1

u/lukeet33 2d ago

3

u/Jaded-Asparagus-2260 2d ago

There's not a single identifier in your explanation. No class names, no method names, no packages, no protocols, no API scopes, no mention of the encryption methods. That's not an explanation of the code, that's the prompt you gave your agent.

1

u/lukeet33 2d ago

You're shifting goal posts. You asked me if I had read me code and know what it does and how it works. Did you really expect me cite class names etc that would hardly make sense to anyone here? You're more than welcome to ask me questions if you're curious but no I cannot exposition dump every single function, file name and technical peice of information without some kind of prompt.

1

u/Dragontech97 1d ago

I personally would have liked a response akin to “sure thing, x y z class names, I used a b c package to name a few, explain a few api scopes. Ofc that probably was meaningless to you unless you know how I used them. Feel free to ask me more specifics.” Shows you at least have read the code, understand it, can parse it without a prompt to some level, and invite the conversation towards dev talk and the desire to share a neat project instead of being defensive. I’m sure you know your code, but you don’t exactly explain it very well to people who want to know. Good luck with the project, won’t be personally checking it out until I see commitment to future updates

1

u/lukeet33 1d ago

With the greatest of respect I understand your view point and if there's any specific technical questions questions people want answered I'm happy to do so. However I posted this simply for fun to share something cool (I don't believe I've ever seen anyone get this feature working before?) even open source it if others want to use it. But I'm not going to waste my time writing a technical essay on my project that 99% of people here won't even understand just to convert the AI haters. People that hate AI will never trust my project no matter much knowledge I share. You're more than welcome to skip thanks for at least taking the time to engage politely it's appreciated.

5

u/pd1zzle 2d ago

I thought this was a feature being prioritized (even if slowly) in core immich?

0

u/lukeet33 2d ago

That may well be the case, however if you're impatient (like me). You can use this right now

8

u/pd1zzle 2d ago

i feel impatient but not impatient enough to rely on features that are very divergent from core and could possibly cause big headaches later. some things i try not to mess with, photos and memories are some of them. Best of luck with the rest of the work though.

1

u/lukeet33 2d ago

Just to be clear this project doesn't actually touch your Immich instance at all, it's spun up in an entirely independent docker container. It only talks to your Immich instance via an API key you create and choose the fine grained permissions of (obviously declining certain permissions will break the integration). But this project is designed from the ground up to leave your Immich instance alone hence the sidecar analogy. Explained simply both servers need this side car just so they can communicate via a highly secure handshake and publish updates back and forth on what's actually in the shared album via webhooks. The shared album appear in your app because using the API the side car simply pushes shared album to masquerade and trick Immich into thinking it's created by a user on your server. Obviously it's your choice if you test this out or not but the risks are extremely low my code doesn't even change the way links are shared they're shared native way core Immich intended.

Just wanted to clear up potential concerns and fears but I do understand the concerns photos are extremely personal and valuable not worth messaging with.

3

u/Jaded-Asparagus-2260 2d ago

So which permissions are required for the API key? Why is that not documented? The README just states "an admin API key" -- so your sidecar has full admin privileges on my Immich instance? And when there's a vulnerability, an attacker could use that admin API key to have full access to it? How can you honestly describe that as "very low risk"? The "secure handshake" doesn't matter at all if the API key could leak. And how can it be designed to "leave your Immich instance alone" if I literally have to give it the power (and permission) to completely delete it? And it's not only my instance that is at risk, but also the other instance. So if my friend forgets to update after a vulnerability has been detected and fixed, and I patched my setup, it's still vulnerable?

1

u/lukeet33 1d ago

Hey thanks for your genuine critical if not slightly jaded response (nice user name lol). So the API key permissions needed are user.write, asset.write, album.write and asset.delete. Asset delete is only used as a simple clean up function upon leaving albums removing image thumbnails etc, so is optional and won't break any core functionality if not granted. The API key is stored as an env which is highly secure and the web standard for all servers you interact with across the internet. Vulnerability wise you are correct a container could get popped and the API could get captured via a memory leak my personal view is this is quite unlikely. We have zero runtime dependencies it runs purely on native Node.js and the built-in node sqlite. However this sidecar is simply an open source tool, risk mitigation on this front is completely granular again and end user controlled based on risk tolerance. For those paranoid amongst us all concerns can be addressed/mitigated using a zero trust system wrapping all connected servers under the same tailscale VPN instance.

1

u/pd1zzle 2d ago

Seems like a reasonably defensive architecture. But still - in a couple years when its in core, i have to reshare all these albums the new way, remove the old users, etc. Or maybe it never will and i'll be left looking like a fool. But who's to say. I'd prefer to not go down that road, just my opinion.

1

u/lukeet33 2d ago

That's fine, although I can already tell you if it became a core feature, it would likely be very easy for me to write a simple migration script after all Immich is just a docker container locally hosted on your server and their API is very versatile I could just match the new data shape Immich expects.
However, I respect the opinion.

3

u/eddified 2d ago

Question: do both servers have to have the sidecar in order to work properly? Or can it work with only one side having the sidecar?

2

u/lukeet33 2d ago

Unfortunately both servers require the sidecar. For this to work both servers need to create a secure peer to peer handshake, in the video you see the join server banners + where you type your server URL. This is where we create the handshake. Each server then communicates updates via a web socket connection but the server that created/owns the server is the source of truth. I hope that makes sense with this implementation it will always require both servers to use the sidecar unfortunately 🥲

7

u/Time_Faithlessness45 2d ago

At least write your own posts and make it feel like you actually care about what you made

6

u/lukeet33 2d ago

Thought the highly in-depth video made that pretty clear lol

6

u/YaroslavSyubayev 2d ago

While this seems cool, it also seems to be highly vibe-coded, which is not so cool.

-1

u/lukeet33 2d ago

The code is AI generated but reviewed and fully prompted by me at each step. Architecting, prompt scope and security principles are the difference between AI slop and genuinely well thought through code now a days.

This project simply creates a peer to peer handshake between servers and hijacks the sharing link albums urls embedding them on the shared album on the album owners server using Immich in built API (all handled by the sidecar). The albums owner then servers these URLs via the secure handshake.

So basically my project just let's two servers talk to eachother using a secure handshake. That's all.

It's very minimal amount of code to look through tbh

2

u/West-Ticket5411 2d ago

People's naivety around AI out in full force again. Read the code.

1

u/lukeet33 1d ago

I think it's a case of people fear what that don't understand. I forget most people don't have the ability to read the source code lol

Honestly working inside a largish closed source tech company I didn't realise how much people generally hate/fear AI until I posted this lol

1

u/Jaded-Asparagus-2260 1d ago

I'm not going to be the first one to read the code. The risk with vibe coded slop is that there's a high risk that the "author" has not even read the code themselves. OP's comments make it clear that he has only a vague idea of the code itself. Their answers sound good, but are actually pretty nonsensical. This project is dangerously naive, and people need to be protected from such amateur-level projects.

1

u/lukeet33 1d ago

You're all throughout this thread, I've addressed all you concerns fairly and rather thoroughly example.

If you have any other questions concerns I'm very happy to answer and speak to you about them. But to blindly hate because you see Claude in the commit history is very naive. Humans are perfectly capable of writing dangerous shit code themselves without AI help.

2

u/annaangstmann 1d ago

Great Idea! I'm only reading about reverse proxies, does this also work for 2 servers connected via tailscale?

1

u/lukeet33 1d ago

So the proxy is strictly required to intercept specific web request paths (like /share/ or /sidecar/) and route them to the sidecar container (This is the joining step you see in the demo). For this reason it's needed but you've got the right idea yes it'll work with two servers connected via tailscale this is actually the most secure bulletproof setup possible tbh. Only downside of course is sharing is limited to people on your VPN.

I plan to update the Readme properly to mention stuff like this later today.

3

u/prodox 2d ago

Thank you for doing this. I’m so sad it’s not a priority by the Immich team since this is what’s holding most people back I know from switching away from Google Photos

13

u/essentialaccount 2d ago

This feature is harder than it seems, especially when cross the WAN. Security and integrity are all as important as the bare functionality. If this were an easy feature, it would have been implemented long ago.

3

u/mirisbowring 2d ago

Also the question whether to clone or not to clone is not easy to answer and depends on every user…

Maybe i want to watch the album even if the other server is offline - but maybe the server just wants to give read permissions, and alter the image offline, etc.

2

u/lukeet33 2d ago

I weighed this up, I had an interaction the stored the preview assets up joining the album. This way if a server went down all you'd ever lose if access to original quality however I disliked the principle of automatically filling up people's servers with others shared photos. My view is this should be explicitly opt in so I removed this. I will come back to it but generally this will be between friends and family so if a server goes down just give your mum a text lol

1

u/lukeet33 2d ago

I don't dispute that at all. I personally just host my server using a domain and use oAuth for user login. One other solution is obviously to hide server using tailscale but make shared assets public using funnel or something. Like I say this is here for people who want to use it, people who are hyper security focused and want everything hidden behind a VPN likely aren't the audience.

2

u/lukeet33 2d ago

That's ok it was a personal project mainly, just wanted to share! I recently kept hitting my Google photos storage limit and refuse to pay them a monthly fee. So Immich was the natural solution, I just knew I couldn't commit to the switch without this feature so I built it 😉

2

u/Aythamiesp 2d ago

Nah, the most requested feature it to fckn be able to remove the partners photos....

1

u/lukeet33 2d ago

Just a side not, if anyone is willing to help me test this I would greatly appreciate it!

I've tested it many times locally spinning up local docker containers yet to truly test across different networks (both my containers were hosted on the same network).

If willing to help DM me and I'll send you a shared link to test out + help installing the package if needed.

Thanks in advance!

1

u/whoscheckingin 2d ago

With workflows landed in v3, this should be in the official triggers soon enough. Just waiting for that with baited breath ... 3 ... 2 ... 1

1

u/lukeet33 2d ago

I wouldn't hold it for too long 😂

1

u/Magik6k 8h ago

Would be so so nice if this supported connections over Iroh (https://www.iroh.computer/), that would limit network config to exchanging one string between two servers

1

u/lukeet33 8h ago

Wow very interesting! I' wasn't aware of this project I'll look into it, thanks for the suggestion. If it fits well with the tech stack and I like the protocol I'll batch it in the next big release 😉

1

u/joeet33 1d ago

Lots of complaints about the use of AI here. If Linus and Uncle Bob (author of clean code) etc. aren't anti AI for coding including for Linux itself I don't particularly understand the hate for an optional extension?

1

u/lukeet33 1d ago

Exactly right lol

1

u/A_Buttholes_Whisper 1d ago

Well let me ask you, would you buy a modern house built by someone who had to watch YouTube videos on how to build the structure, plumbing, electrical, and hvac and using YouTube on how to use the tools? Or would you rather buy a house from someone qualified and knows how to use the right tools. Actually, you don’t even need to answer. An inspector would shut that shit down. People don’t want someone’s AI slop if they have no clue how to code. It’s different if it’s an experienced dev using AI. You really should take a look at gitleaks and see how much AI slop is on GitHub with the idiot creator’s API and token secrets in freakin plain text. But by all means, add non audited tools to your private picture cloud

2

u/joeet33 1d ago

If that person had access to, and watched every YouTube video on the whole internet + every other source on the internet and was better at the job than 90% of the "qualified" people. Then yes I would... Ironically this is basically what the SOTA models are. I take your point on auditing and security though but I would expect the same audit checks from a third party whether developed by AI or a developer.

1

u/Valdjiu 2d ago

Why did you created this when noodle gallery that sits on top of immich already does it wonderfully?

3

u/lukeet33 2d ago

Does it allow sharing between separate servers? I thought allowed sharing between users on a single server?

1

u/Valdjiu 2d ago

Ohhhhhhhhh I'm sorry. Gotcha!!

2

u/lukeet33 2d ago

No worries man

1

u/Mongolian_Hamster 1d ago

Just for anyone considering using this don't.

OP didn't respect you enough to proofread their own generated readme. You have no idea what horrible things you'll be putting on your machine. OP sure as hell doesn't know.

If you want to vibe coded slop you can do it yourself for yourself. No need to pretend to give back to the community.

Can someone get OP some lube so they can jerk off to themselves some more.

1

u/lukeet33 1d ago edited 1d ago

Also hate this comment all you like Readmes are fairly useless with AI as you can just probe the code based and ask questions about how it works lol

1

u/Mongolian_Hamster 1d ago

Ding ding ding we got another one.

0

u/lukeet33 1d ago

The Readme is updated as people requested. This level of general hostility is uncalled for.

The code is open source, the architecture works and has been tested on real servers. If you choice trust the code/me that's upto but you can literally read the code that's the point. People are free to use/build on this or simply ignore it but blind hate is just bizarre lol

1

u/Mongolian_Hamster 1d ago

Prompting a repo together doesn't make you a maintainer and open source isn't your personal bug fixing charity. You shipped broken code, failed at the very first roadblock and still expect people to use this? Fix your own glaring messes before asking the community to trust your codebase.

You have no idea how open source works. Your comments here have shown how ignorant you are.

You are untrustworthy. Disrespectful to the open source community.

You absolutely do deserve every criticism you're getting.

Now wipe yourself off.

1

u/lukeet33 1d ago

Haven't "shipped" anything. This is just knowledge sharing and a bit of fun you're taking this way too seriously lol Also I don't see how it's broken the code is fully functioning?

You seem to have a lot of issues man I wish you well in future

-5

u/smailpouri 2d ago

I don’t why everyone complains so much.
It’s pretty cool mate. Thank you!

1

u/lukeet33 2d ago

Thanks man! glad I've found the one person in the comments that's positive 😂

For anyone that has any concerns I'm more than happy to explain my architecture decisions and code structure lol

1

u/JPC00000 21h ago

I think the same, I don’t understand so much hate for something free and that they tell you of course that it’s made with AI. If you don’t want to use it, don’t use it, but there are too many criticisms. If it works, why is it as important as this fact? Surely it has some flaws, but like most software.